https://portstatus.bsdproject.de now writes VuXML entries for you. Tick the unaddressed CVEs on a port page and you get a ready entry: the package names the port really builds, ranges in pkg notation with epoch and revision, one range per epoch the port had, every bound checked with libpkg.
The limit is CPE. Only 3,331 of 34,927 ports carry one, the rest never get matched. Ports sharing a CPE can get a version that never existed for them, so check before you commit.
wie gehts?
henlo